Selected New Instruments in Personal Data Protection under the GDPR

In the field of personal data protection the Regulation introduced new instruments, in particular the right to object to processing and the right to erasure, extended into the right to be forgotten. The definition of personal data was also broadened and a notification duty introduced: the controller must now report a breach or compromise of the security of personal data to the Úřad pro ochranu osobních údajů (Czech Data Protection Authority) no later than 72 hours after becoming aware of the incident.

The right to object is set out in Article 21 of the GDPR and allows the data subject to object at any time to the processing of their personal data. The data subject may do so on grounds relating to their particular situation where personal data concerning them are processed under Article 6(e), namely where "processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller", or under Article 6(f), namely where "processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child", including profiling based on those two provisions. The controller must then cease processing the personal data unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or grounds for the establishment, exercise or defence of legal claims. The data subject also has the right to object at any time to the processing of personal data concerning them for direct marketing purposes, which includes profiling to the extent that it relates to such direct marketing. Once an objection to processing for direct marketing purposes has been raised, the personal data may no longer be processed for those purposes.

The right to erasure, otherwise known as the right to be forgotten, entitles the data subject to require the controller to erase personal data concerning them without undue delay, and the controller is obliged to erase such data without undue delay, but only where one of the grounds set out in Article 17 of the Regulation applies, namely:

• the personal data are no longer necessary for the purposes for which they were collected or otherwise processed;
• the data subject withdraws the consent on which the lawful processing for one or more specific purposes was based, or on which the data subject gave explicit consent to the processing of special categories of personal data under Article 9 of the GDPR, save where Union or Member State law provides that the prohibition on processing special categories of personal data may not be lifted by the data subject, and there is no other legal ground for the processing;
• the data subject objects to the processing under Article 21(1) of the GDPR and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing under Article 21(2) of the GDPR;
• the personal data have been unlawfully processed;
• the personal data must be erased for compliance with a legal obligation under Union or Member State law to which the controller is subject;
• the personal data were collected in relation to the offer of information society services directly to a child under Article 8(1) of the GDPR ("Where point (a) of Article 6(1) applies, in relation to the offer of information society services directly to a child, the processing of the personal data of a child shall be lawful where the child is at least 16 years old. Where the child is below the age of 16 years, such processing shall be lawful only if and to the extent that consent is given or authorised by the holder of parental responsibility over the child").

Under Article 17(2) of the GDPR: "Where the controller has made the personal data public and is obliged pursuant to paragraph 1 to erase the personal data, the controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that the data subject has requested the erasure by such controllers of any links to, or copy or replication of, those personal data." That provision concerns above all personal information published online. The data subject must first submit a request for erasure, which is then assessed by specialist staff who decide whether or not to grant it. The assessment turns primarily on whether the individual's right to be forgotten outweighs the public's right to information.

The right to erasure cannot be invoked where the processing is necessary. The exceptions are specifically these: for exercising the right of freedom of expression and information; for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; for reasons of public interest in the area of public health in accordance with Article 9(2)(h) and (i) and Article 9(3) of the GDPR; for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) of the GDPR, in so far as the right to erasure is likely to render impossible or seriously impair the achievement of the objectives of that processing; and, not least, for the establishment, exercise or defence of legal claims.

Regulation (EU) 2016/679 of the European Parliament and of the Council seeks to respond to technological and social developments which had rendered the previous European rules on personal data protection, contained in Directive 95/46/EC, outdated and inadequate to the demands of the present day. Under the new Regulation, personal data are defined in Article 4(1) as: "any information relating to an identified or identifiable natural person ('data subject'); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person."